Katalog CVE (hal. 943)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 267.555 (Critical 36.782 · High 106.936 · KEV 1.767 · sejak 2020) · Pembaruan terakhir: 4 Nov 2026, 12:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 47.101–47.150 dari 267.555 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-16158 fastify/reply-from Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a...	10.0 Critical	—	0,38%	18 Jul 2026
CVE-2026-15631 fastify/http-proxy Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix....	10.0 Critical	—	0,50%	18 Jul 2026
CVE-2026-16097 A vulnerability was found in Shibby Tomato 1.28. This vulnerability affects the function sub_42537C of the component Scheduler Name Handler. The manipulation of the argum...	8.8 High	—	0,79%	18 Jul 2026
CVE-2026-16096 A vulnerability has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. This affects the function sub_40BB50 of the file /proc/webmon_recent_domains. The manipulati...	8.8 High	—	0,54%	18 Jul 2026
CVE-2026-16095 A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setup_conntrack of the file /sbin/rc. Executing a manipulation...	8.8 High	—	0,73%	18 Jul 2026
CVE-2026-16088 A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Fi...	4.7 Medium	—	0,49%	18 Jul 2026
CVE-2026-16085 A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function NewContextBuilder of the file pkg/agent/context.go. Such manipulation...	5.3 Medium	—	0,16%	18 Jul 2026
CVE-2026-47871 broadcom vmware avi load balancer VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory tra...	8.8 High	—	0,96%	18 Jul 2026
CVE-2026-47870 broadcom vmware avi load balancer VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code. Affected v...	8.8 High	—	0,42%	18 Jul 2026
CVE-2026-47869 broadcom vmware avi load balancer VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code. Affec...	8.8 High	—	0,74%	18 Jul 2026
CVE-2026-47868 broadcom vmware avi load balancer VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as r...	7.8 High	—	0,14%	18 Jul 2026
CVE-2026-47867 broadcom vmware avi load balancer VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code...	8.8 High	—	0,74%	18 Jul 2026
CVE-2026-47866 broadcom vmware avi load balancer VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without pro...	8.3 High	—	0,38%	18 Jul 2026
CVE-2026-47865 broadcom vmware avi load balancer VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing th...	9.8 Critical	—	0,61%	18 Jul 2026
CVE-2026-16084 A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation causes serv...	7.3 High	—	0,56%	18 Jul 2026
CVE-2026-16083 A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component...	5.3 Medium	—	0,72%	18 Jul 2026
CVE-2026-16082 A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The man...	5.3 Medium	—	0,12%	18 Jul 2026
CVE-2026-16081 A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation c...	4.3 Medium	—	0,24%	18 Jul 2026
CVE-2026-16077 A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5. Impacted is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py of the comp...	5.3 Medium	—	0,21%	18 Jul 2026
CVE-2026-16076 A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrbot/dashboard/routes/open_api.p...	6.3 Medium	—	0,51%	18 Jul 2026
CVE-2026-9734 The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or inc...	4.3 Medium	—	0,19%	18 Jul 2026
CVE-2026-16075 A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the file astrbot/dashboard/routes/ope...	4.3 Medium	—	0,37%	18 Jul 2026
CVE-2026-57980 microsoft edge chromium Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.	5.4 Medium	—	0,39%	17 Jul 2026
CVE-2026-56741 jline JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to te...	7.5 High	—	0,60%	17 Jul 2026
CVE-2026-56740 jline JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of enviro...	7.5 High	—	0,59%	17 Jul 2026
CVE-2026-56171 microsoft remote desktop web client, microsoft windows admin center Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network.	7.5 High	—	0,66%	17 Jul 2026
CVE-2026-54335 Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility expor...	3.7 Low	—	0,39%	17 Jul 2026
CVE-2026-49485 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine...	7.5 High	—	0,68%	17 Jul 2026
CVE-2026-48049 @hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the dir...	5.3 Medium	—	0,59%	17 Jul 2026
CVE-2026-48022 @hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-...	6.5 Medium	—	0,18%	17 Jul 2026
CVE-2026-44979 @hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are str...	6.3 Medium	—	0,42%	17 Jul 2026
CVE-2026-55518 Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the...	9.6 Critical	—	0,41%	17 Jul 2026
CVE-2026-54498 viewcomponent view component view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base#around_rend...	8.7 High	—	0,45%	17 Jul 2026
CVE-2026-54497 viewcomponent view component view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances r...	6.8 Medium	—	0,33%	17 Jul 2026
CVE-2026-54490 websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or...	6.3 Medium	—	0,45%	17 Jul 2026
CVE-2026-54466 faye websocket-driver websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header...	7.5 High	—	0,38%	17 Jul 2026
CVE-2026-54244 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Co...	3.5 Low	—	0,30%	17 Jul 2026
CVE-2026-54243 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not...	6.1 Medium	—	0,34%	17 Jul 2026
CVE-2026-54242 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidat...	4.9 Medium	—	0,23%	17 Jul 2026
CVE-2026-54163 secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secure_headers builds the Content-Security-Policy value by stitching direc...	4.7 Medium	—	0,21%	17 Jul 2026
CVE-2026-54159 PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from th...	10.0 Critical	—	0,75%	17 Jul 2026
CVE-2026-53727 premailer css parser css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_uri! and the @import-following...	8.6 High	—	0,51%	17 Jul 2026
CVE-2026-52584 Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function	7.1 High	—	0,12%	17 Jul 2026
CVE-2026-52348 cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.	9.8 Critical	—	0,47%	17 Jul 2026
CVE-2026-52203 An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.	7.5 High	—	0,52%	17 Jul 2026
CVE-2026-50274 Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries t...	7.5 High	—	0,79%	17 Jul 2026
CVE-2026-50272 dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propag...	7.5 High	—	0,79%	17 Jul 2026
CVE-2026-50271 Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers...	7.5 High	—	0,79%	17 Jul 2026
CVE-2026-49977 tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not...	4.3 Medium	—	0,35%	17 Jul 2026
CVE-2026-48062 CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived g...	9.8 Critical	—	0,78%	17 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.